Cyber Grants Alliance pushes DIB manufacturers to seek CMMC gap assessment grants

Cyber Grants Alliance is urging defense industrial base manufacturers to use Level 1 and Level 2 gap assessment grants before changing CMMC enforcement rules trigger new compliance pressure. The group says self-assessment, NIST 800-171 and DFARS obligations remain in force even after DoD suspended Phase 2 third-party assessments on July 13, 2026.

Why it matters: - Defense industrial base manufacturers still have to meet cybersecurity obligations tied to federal contracts, even as CMMC third-party assessment timelines shift. - Cyber Grants Alliance says companies that wait could face rushed remediation, lost contract opportunities and added compliance risk. - The group is steering manufacturers toward funded gap assessments now, before the next enforcement path becomes clearer.

What happened: - Cyber Grants Alliance on July 23 urged DIB manufacturing companies to act on cybersecurity compliance after the Department of Defense suspended Phase 2 CMMC third-party assessments on July 13, 2026. - The nonprofit said the pause does not change mandatory self-assessment requirements, NIST SP 800-171 Rev. 2 compliance or DFARS 252.204-7012 safeguarding obligations. - Rick Dassler, executive director of Cyber Grants Alliance, said, "Manufacturers cannot afford to sit on the sidelines." - Dassler said establishing an accurate baseline now is a crucial step to safeguard defense contracts. - Cyber Grants Alliance directed companies to apply for its Level 1 Grant and Level 2 Grant.

The details: - The organization says Level 1 gap assessment grants provide $5,000 in-kind support. - The Level 1 program evaluates 17 basic cyber hygiene practices across six control families under FAR 52.204-21. - Cyber Grants Alliance says the Level 1 assessment is meant to help small manufacturers submit accurate SPRS self-affirmations. - The Level 2 gap assessment grants provide $10,000 in-kind support. - The Level 2 program evaluates all 110 NIST SP 800-171 Rev. 2 controls across 14 control families. - Cyber Grants Alliance says the Level 2 assessment is designed for companies handling Controlled Unclassified Information. - The group says the grants are meant to remove financial barriers to readiness work. - Cyber Grants Alliance described itself as a nonprofit focused on cybersecurity access for small and medium-sized businesses serving the defense industrial base.

Between the lines: - The pause in third-party assessments may reduce immediate certification pressure, but it does not eliminate the underlying security work companies must complete. - Cyber Grants Alliance is framing gap assessments as both a compliance tool and a competitive signal for prime contractor relationships. - The organization also argues that documented assessments can reduce the risk of later, unfunded remediation if the government changes the framework again. - The message reflects a broader market reality: contract access can depend on proof of cybersecurity readiness, not just final certification status.

What's next: - Cyber Grants Alliance expects manufacturers to use the 60-day review period to document compliance gaps and prepare remediation plans. - The group says companies without baseline assessments could face tighter deadlines if Phase 2 requirements are modified, reinstated or replaced. - Manufacturers seeking the grants can apply through Cyber Grants Alliance's Level 1 Grant and Level 2 Grant programs. - Cyber Grants Alliance also points companies to its LinkedIn page and Facebook page.

The bottom line: - Cyber Grants Alliance is telling DIB manufacturers not to treat the CMMC pause as a compliance reset. The group says the safest move is to document gaps now and keep preparing for whatever framework comes next.